{"id":"CVE-2025-11538","aliases":["EUVD-2025-175330","GHSA-7m9g-pmxf-m9m8","GHSA-j4vq-q93m-4683"],"status":"published","title":"Keycloak-server: debug default bind address","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00425,"percentile":0.3718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1327"],"published":"2025-11-13T16:47:53Z","modified":"2026-11-11T02:47:40Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-dist","fixed_in":["26.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-dist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.4.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-dist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.4.4"}]}],"versions":["17.0.0","17.0.1","18.0.0","18.0.1","18.0.2","19.0.0","19.0.1","19.0.2","19.0.3","20.0.0","20.0.1","20.0.2","20.0.3","20.0.5","21.0.0","21.0.1","21.0.2","21.1.0","21.1.1","21.1.2","22.0.0","22.0.1","22.0.2","22.0.3","22.0.4","22.0.5","23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","24.0.0","24.0.1","24.0.2","24.0.3","24.0.4","24.0.5","25.0.0","25.0.1","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","26.0.0","26.0.1","26.0.2","26.0.4","26.0.5","26.0.6","26.0.7","26.0.8","26.1.0","26.1.1","26.1.2","26.1.3","26.1.4","26.1.5","26.2.0","26.2.1","26.2.2","26.2.3","26.2.4","26.2.5","26.3.0","26.3.1","26.3.2","26.3.3","26.3.4","26.3.5","26.4.0","26.4.1","26.4.2","26.4.3"]}],"products":[{"vendor":"keycloak","product":"keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 26.4"},{"vendor":"red hat","product":"red hat build of keycloak 26.4.4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:21370","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21371","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11538","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402622","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9","tags":["fix","web"]},{"url":"https://github.com/keycloak/keycloak/pull/43574","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11538","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7m9g-pmxf-m9m8"},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-j4vq-q93m-4683","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j4vq-q93m-4683"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11538.json","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-11538","title":"Keycloak-server: debug default bind address","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"published","published":"2025-11-13T16:47:53.933Z","modified":"2025-12-19T21:26:09.332Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-175330","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"published","published":"2025-11-13T16:47:53Z","modified":"2025-12-19T21:26:09Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:02.188903Z"}],"ghsa":[{"id":"GHSA-7m9g-pmxf-m9m8","title":"Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.\n\n### Original Description\nA vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"withdrawn","published":"2025-11-13T18:31:05Z","modified":"2025-12-20T05:40:50Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T14:39:14.093341Z"},{"id":"GHSA-j4vq-q93m-4683","title":"Keycloak has debug default bind address","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (`--debug`) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (`0.0.0.0`). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.\n\nRed Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.","status":"published","published":"2025-12-02T00:35:03Z","modified":"2025-12-02T00:35:05Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"nvd":[{"id":"CVE-2025-11538","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"published","published":"2025-11-13T17:15:44.82Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T14:11:43.650381Z"}],"osv":[{"id":"CVE-2025-11538","title":"Keycloak-server: debug default bind address","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"published","published":"2025-11-13T16:47:53.933Z","modified":"2026-11-11T10:47:18.452874747Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1327"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-7m9g-pmxf-m9m8","title":"Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.\n\n### Original Description\nA vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug \u003cport\u003e) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.","status":"withdrawn","published":"2025-11-13T18:31:05Z","modified":"2026-09-10T03:50:30.55678685Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"GHSA-j4vq-q93m-4683","title":"Keycloak has debug default bind address","description":"A vulnerability exists in Keycloak's server distribution where enabling debug mode (`--debug`) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (`0.0.0.0`). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.\n\nRed Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.","status":"published","published":"2025-12-02T00:35:03Z","modified":"2025-12-02T01:29:45.510324Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}